T08 · Insecure Dependencies
- Location
SKILL.md:122- Finding
Unpinned npm Package Is Downloaded and Executed Automatically
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 122
Vulnerability Type: Supply-chain risk caused by dynamic execution of an unpinned dependency
Risk Level: MediumVulnerable Code
bash npx -y @mermaid-js/mermaid-cli mmdc -i diagram.mmd -o diagram.png -b transparentA related installation instruction appears at
SKILL.md, line 232:text | Mermaid CLI | npm package | Optional | `npm i -g @mermaid-js/mermaid-cli` |Technical Analysis
The documented PNG export procedure invokes
npxwith the-yoption and does not specify an exact package version or verify package integrity. As a result, npm can resolve, download, install, and execute a mutable package release and its transitive dependencies without an interactive confirmation step.The package name is consistent with the Skill's declared diagram-rendering purpose, and there is no evidence that the package itself is malicious. Nevertheless, the execution model creates a supply-chain trust boundary: code executed during installation or rendering is retrieved from an external npm registry and is not included in the audited project. The effective executable payload can therefore change after this Skill has been reviewed.
The global installation alternative has the same lack of version pinning and additionally places the package in a shared environment, potentially affecting later executions.
Attack Path
- A user asks the agent to export a Mermaid diagram as PNG.
- The agent follows the documented command and invokes
npx -y @mermaid-js/mermaid-cli. - npm resolves the package and its transitive dependencies from the configured registry without requiring confirmation.
- A compromised release, registry account, registry endpoint, or transitive dependency supplies attacker-controlled installation or runtime code.
- npm executes that code with the operating-system privileges and environment available to the agent process.
- The malicious dependency can acce ...[truncated 717 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin Mermaid CLI to a reviewed, exact version rather than resolving the latest available release:
bash npx --yes --package=@mermaid-js/mermaid-cli@<audited-exact-version> mmdc -i diagram.mmd -o diagram.png -b transparent -
Prefer declaring the dependency in
package.json, committing a lockfile, and installing it through a reproducible workflow such asnpm ci. -
Verify lockfile integrity metadata and use a trusted, explicitly configured npm registry.
-
Separate dependency installation from normal Skill execution. Require explicit user or administrator approval before downloading executable packages.
-
Run Mermaid rendering in an isolated sandbox or container with:
- No unnecessary secrets or credentials
- Read-only access to unrelated project files
- A dedicated temporary output directory
- Restricted outbound network access
- No elevated operating-system privileges
-
Avoid global package installation. A project-local, version-locked dependency reduces shared-environment impact and improves reproducibility.
-
Regularly review the pinned package and transitive dependency tree for published vulnerabilities before upgrading.
-